Re: [ 01/82] Bluetooth: Always compile SCO and L2CAP in Bluetooth Core

Hi Ben, * Ben Hutchings [2012-11-14 05:39:34 +]: > 3.2-stable review patch. If anyone has any objections, please let me know. > > -- > > From: Ulisses Furquim > > commit f1e91e1640d808d332498a6b09b2bcd01462eff9 upstream. > > The handling of SCO audio links and the L2CAP

Re: [ 01/82] Bluetooth: Always compile SCO and L2CAP in Bluetooth Core

From: Gustavo Padovan Date: Wed, 14 Nov 2012 19:24:26 -0200 > Hi Ben, > > * Ben Hutchings [2012-11-14 05:39:34 +]: > >> 3.2-stable review patch. If anyone has any objections, please let me know. >> >> -- >> >> From: Ulisses Furquim >> >> commit f1e91e1640d808d332498a6b

Re: [ 01/82] Bluetooth: Always compile SCO and L2CAP in Bluetooth Core

On Wed, Nov 14, 2012 at 04:30:44PM -0500, David Miller wrote: > From: Gustavo Padovan > Date: Wed, 14 Nov 2012 19:24:26 -0200 > > > Hi Ben, > > > > * Ben Hutchings [2012-11-14 05:39:34 +]: > > > >> 3.2-stable review patch. If anyone has any objections, please let me know. > >> > >> -

Patch Upstream: device_cgroup: fix RCU usage

commit: 201e72acb2d3821e2de9ce6091e98859c316b29a From: Tejun Heo Date: Tue, 6 Nov 2012 09:17:37 -0800 Subject: device_cgroup: fix RCU usage dev_cgroup->exceptions is protected with devcgroup_mutex for writes and RCU for reads; however, RCU usage isn't correct. * dev_exception_clean() doesn't use

patch "tty: serial: max310x: Add terminating entry for spi_device_id table" added to tty tree

This is a note to let you know that I've just added the patch titled tty: serial: max310x: Add terminating entry for spi_device_id table to my tty git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git in the tty-linus branch. The patch will show up

patch "firmware loader: Fix the race FW_STATUS_DONE is followed by" added to driver-core tree

This is a note to let you know that I've just added the patch titled firmware loader: Fix the race FW_STATUS_DONE is followed by to my driver-core git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git in the driver-core-next branch. The patc

patch "firmware loader: Fix the concurrent request_firmware() race for" added to driver-core tree

This is a note to let you know that I've just added the patch titled firmware loader: Fix the concurrent request_firmware() race for to my driver-core git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git in the driver-core-next branch. The

Re: [3.6.6] panic on reboot / khungtaskd blocked? (WARNING: at arch/x86/kernel/smp.c:123 native_smp_send_reschedule)

On 11/15/2012 05:10 AM, Paweł Sikora wrote: > On Wednesday 14 of November 2012 10:32:41 Michael Wang wrote: >> On 11/13/2012 05:40 PM, Paweł Sikora wrote: >>> On Monday 12 of November 2012 13:33:39 Paweł Sikora wrote: On Monday 12 of November 2012 11:22:47 Paweł Sikora wrote: > On Monday 1

Re: [PATCHES] Networking fixes for -stable.

From: Ben Hutchings Date: Tue, 13 Nov 2012 19:51:26 + > On Mon, 2012-11-12 at 00:25 -0500, David Miller wrote: >> Please queue up the following networking bug fixes for >> 3.0.x, 3.2.x, 3.4.x, and 3.6.x, respectively. > [...] >> From 2204849a85383fbde75680aa199142abe504adbb Mon Sep 17 00:00:0

Re: [PATCHES] Networking fixes for -stable.

On Wed, Nov 14, 2012 at 10:31:45PM -0500, David Miller wrote: > From: Ben Hutchings > Date: Tue, 13 Nov 2012 19:51:26 + > > > On Mon, 2012-11-12 at 00:25 -0500, David Miller wrote: > >> Please queue up the following networking bug fixes for > >> 3.0.x, 3.2.x, 3.4.x, and 3.6.x, respectively. >

Re: [PATCHES] Networking fixes for -stable.

On Mon, Nov 12, 2012 at 12:25:58AM -0500, David Miller wrote: > > Please queue up the following networking bug fixes for > 3.0.x, 3.2.x, 3.4.x, and 3.6.x, respectively. Oops, forgot to mention that these are all applied now for the 3.0, 3.4, and 3.6 kernels. greg k-h -- To unsubscribe from this

[ 00/38] 3.0.52-stable review

This is the start of the stable review cycle for the 3.0.52 release. There are 38 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Nov 17 04:09:25 UTC 2012. Anything receive

[ 03/38] target: Dont return success from module_init() if setup fails

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Roland Dreier commit 0d0f9dfb31e0a6c92063e235417b42df185b3275 upstream. If the call to core_dev_release_virtual_lun0() fails, then nothing sets ret to anything other than 0, so even though ever

[ 14/38] NFS: fix bug in legacy DNS resolver.

3.0-stable review patch. If anyone has any objections, please let me know. -- From: NeilBrown commit 8d96b10639fb402357b75b055b1e82a65ff95050 upstream. The DNS resolver's use of the sunrpc cache involves a 'ttl' number (relative) rather that a timeout (absolute). This confuse

[ 16/38] drm: restore open_count if drm_setup fails

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Ilija Hadzic commit 0f1cb1bd94a9c967cd4ad3de51cfdabe61eb5dcc upstream. If drm_setup (called at first open) fails, the whole open call has failed, so we should not keep the open_count incremente

[ 31/38] ipv6: send unsolicited neighbour advertisements to all-nodes

3.0-stable review patch. If anyone has any objections, please let me know. -- From: Hannes Frederic Sowa [ Upstream commit 60713a0ca7fd6651b951cc1b4dbd528d1fc0281b ] As documented in RFC4861 (Neighbor Discovery for IP version 6) 7.2.6., unsolicited neighbour advertisements sh

[ 06/57] rt2800: validate step value for temperature compensation

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Stanislaw Gruszka commit bf7e1abe434ba9e22e8dc04a4cba4ab504b788b8 upstream. Some hardware has correct (!= 0xff) value of tssi_bounds[4] in the EEPROM, but step is equal to 0xff. This results on

[ 20/57] mac80211: make sure data is accessible in EAPOL check

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit 6dbda2d00d466225f9db1dc695ff852443f28832 upstream. The code to allow EAPOL frames even when the station isn't yet marked associated needs to check that the incoming frame i

[ 27/57] NFS: fix bug in legacy DNS resolver.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: NeilBrown commit 8d96b10639fb402357b75b055b1e82a65ff95050 upstream. The DNS resolver's use of the sunrpc cache involves a 'ttl' number (relative) rather that a timeout (absolute). This confuse

[ 49/57] mmc: sdhci: fix NULL dereference in sdhci_request() tuning

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Chris Ball commit 14efd957209461bbdf285bf0d67e931955d04a4c upstream. Commit 473b095a72a9 ("mmc: sdhci: fix incorrect command used in tuning") introduced a NULL dereference at resume-time if an

[ 52/57] drm/radeon/cayman: add some missing regs to the VM reg checker

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit 860fe2f05fa2eacac84368e23547ec8cf3cc6652 upstream. These regs were being wronly rejected leading to rendering issues. fixes: https://bugs.freedesktop.org/show_bug.cgi?id=56

Re: [PATCHES] Networking fixes for -stable.

From: Greg KH Date: Wed, 14 Nov 2012 20:06:59 -0800 > On Mon, Nov 12, 2012 at 12:25:58AM -0500, David Miller wrote: >> >> Please queue up the following networking bug fixes for >> 3.0.x, 3.2.x, 3.4.x, and 3.6.x, respectively. > > Oops, forgot to mention that these are all applied now for the 3.

[ 54/57] drm/i915: fixup infoframe support for sdvo

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Vetter commit 81014b9d0b55fb0b48f26cd2a943359750d532db upstream. At least the worst offenders: - SDVO specifies that the encoder should compute the ecc. Testing also shows that we must

[ 57/57] xfs: fix reading of wrapped log data

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Dave Chinner commit 6ce377afd1755eae5c93410ca9a1121dfead7b87 upstream. Commit 4439647 ("xfs: reset buffer pointers before freeing them") in 3.0-rc1 introduced a regression when recovering log b

[ 56/57] USB: mos7840: remove unused variable

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johan Hovold Fix warning about unused variable introduced by commit e681b66f2e19fa ("USB: mos7840: remove invalid disconnect handling") upstream. A subsequent fix which removed the disconnect f

[ 55/57] drm/i915: clear the entire sdvo infoframe buffer

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Daniel Vetter commit b6e0e543f75729f207b9c72b0162ae61170635b2 upstream. Like in the case of native hdmi, which is fixed already in commit adf00b26d18e1b3570451296e03bcb20e4798cdd Author: Paulo

[ 45/57] net: inet_diag -- Return error code if protocol handler is missed

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Cyrill Gorcunov [ Upstream commit cacb6ba0f36ab14a507f4ee7697e8332899015d2 ] We've observed that in case if UDP diag module is not supported in kernel the netlink returns NLMSG_DONE without no

[ 53/57] drm/radeon/si: add some missing regs to the VM reg checker

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit f418b88aad0c42b4caf4d79a0cf8d14a5d0a2284 upstream. This register is needed for streamout to work properly. Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Signed-o

[ 51/57] drm/vmwgfx: Fix a case where the code would BUG when trying to pin GMR memory

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Hellstrom commit afcc87aa6a233e52df73552dc1dc9ae3881b7cc8 upstream. Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Dmitry Torokhov Cc: linux-graphics-maintai...@

[ 48/57] futex: Handle futex_pi OWNER_DIED take over correctly

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 59fa6245192159ab5e1e17b8e31f15afa9cff4bf upstream. Siddhesh analyzed a failure in the take over of pi futexes in case the owner died and provided a workaround. See: http:

[ 50/57] drm/vmwgfx: Fix hibernation device reset

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Hellstrom commit 95e8f6a21996c4cc2c4574b231c6e858b749dce3 upstream. The device would not reset properly when resuming from hibernation. Signed-off-by: Thomas Hellstrom Reviewed-by: Bri

[ 47/57] ipv6: send unsolicited neighbour advertisements to all-nodes

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Hannes Frederic Sowa [ Upstream commit 60713a0ca7fd6651b951cc1b4dbd528d1fc0281b ] As documented in RFC4861 (Neighbor Discovery for IP version 6) 7.2.6., unsolicited neighbour advertisements sh

[ 46/57] af-packet: fix oops when socket is not present

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Leblond [ Upstream commit a3d744e995d2b936c500585ae39d99ee251c89b4 ] Due to a NULL dereference, the following patch is causing oops in normal trafic condition: commit c0de08d04215031d68f

[ 21/57] mac80211: fix SSID copy on IBSS JOIN

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Antonio Quartulli commit badecb001a310408d3473b1fc2ed5aefd0bc92a9 upstream. The 'ssid' field of the cfg80211_ibss_params is a u8 pointer and its length is likely to be less than IEEE80211_MAX_S

[ 23/57] nfs: Show original device name verbatim in /proc/*/mount{s,info}

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Ben Hutchings commit 97a54868262da1629a3e65121e65b8e8c4419d9f upstream. Since commit c7f404b ('vfs: new superblock methods to override /proc/*/mount{s,info}'), nfs_path() is used to generate th

[ 24/57] NFSv4: nfs4_locku_done must release the sequence id

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Trond Myklebust commit 2b1bc308f492589f7d49012ed24561534ea2be8c upstream. If the state recovery machinery is triggered by the call to nfs4_async_handle_error() then we can deadlock. Signed-off

[ 36/57] ALSA: Avoid endless sleep after disconnect

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 0914f7961babbf28aaa2f19b453951fb4841c03f upstream. When disconnect callback is called, each component should wake up sleepers and check card->shutdown flag for avoiding the

[ 40/57] ipv6: Set default hoplimit as zero.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Li RongQing [ Upstream commit 14edd87dc67311556f1254a8f29cf4dd6cb5b7d1 ] Commit a02e4b7dae4551(Demark default hoplimit as zero) only changes the hoplimit checking condition and default value i

[ 39/57] tcp: fix FIONREAD/SIOCINQ

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit a3374c42aa5f7237e87ff3b0622018636b0c847e ] tcp_ioctl() tries to take into account if tcp socket received a FIN to report correct number bytes in receive queue.

[ 41/57] net: usb: Fix memory leak on Tx data path

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Hemant Kumar [ Upstream commit 39707c2a3ba5011038b363f84d37c8a98d2d9db1 ] Driver anchors the tx urbs and defers the urb submission if a transmit request comes when the interface is suspended.

[ 37/57] sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Zijie Pan [ Upstream commit f6e80abeab928b7c47cc1fbf53df13b4398a2bec ] Bug introduced by commit edfee0339e681a784ebacec7e8c2dc97dc6d2839 (sctp: check src addr when processing SACK to update tr

[ 44/57] l2tp: fix oops in l2tp_eth_create() error path

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Tom Parkin [ Upstream commit 789336360e0a2aeb9750c16ab704a02cbe035e9e ] When creating an L2TPv3 Ethernet session, if register_netdev() should fail for any reason (for example, automatic naming

[ 43/57] drivers/net/ethernet/nxp/lpc_eth.c: Call mdiobus_unregister before mdiobus_free

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Peter Senna Tschudin [ Upstream commit 57c10b61c84bfed68b1b317d6f507a392724b9c4 ] Based on commit b27393aecf66199f5ddad37c302d3e0cfadbe6c0 Calling mdiobus_free without calling mdiobus_unregis

[ 42/57] net: fix divide by zero in tcp algorithm illinois

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Jesper Dangaard Brouer [ Upstream commit 8f363b77ee4fbf7c3bbcf5ec2c5ca482d396d664 ] Reading TCP stats when using TCP Illinois congestion control algorithm can cause a divide by zero kernel oop

[ 38/57] netlink: use kfree_rcu() in netlink_release()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 6d772ac5578f711d1ce7b03535d1c95bffb21dff ] On some suspend/resume operations involving wimax device, we have noticed some intermittent memory corruptions in netl

[ 28/57] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Trond Myklebust [Fixed upstream as part of 0b728e1911c, but that's a much larger patch, this is only the nfs portion backported as needed.] Fix the following Oops in 3.5.1: BUG: unable to han

[ 35/57] ALSA: Add a reference counter to card instance

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85 upstream. For more strict protection for wild disconnections, a refcount is introduced to the card instance, and let it up/down when

[ 34/57] ALSA: usb-audio: Fix races at disconnection in mixer_quirks.c

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 888ea7d5ac6815ba16b3b3a20f665a92c7af6724 upstream. Similar like the previous commit, cover with chip->shutdown_rwsem and chip->shutdown checks. Reported-by: Matthieu CASTE

[ 33/57] ALSA: usb-audio: Use rwsem for disconnect protection

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 34f3c89fda4fba9fe689db22253ca8db2f5e6386 upstream. Replace mutex with rwsem for codec->shutdown protection so that concurrent accesses are allowed. Also add the protection

[ 32/57] ALSA: usb-audio: Fix races at disconnection

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 978520b75f0a1ce82b17e1e8186417250de6d545 upstream. Close some races at disconnection of a USB audio device by adding the chip->shutdown_mutex and chip->shutdown check at app

[ 31/57] ALSA: PCM: Fix some races at disconnection

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Takashi Iwai commit 9b0573c07f278e9888c352aa9724035c75784ea0 upstream. Fix races at PCM disconnection: - while a PCM device is being opened or closed - while the PCM state is being changed with

[ 30/57] hwmon: (w83627ehf) Force initial bank selection

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Jean Delvare commit 3300fb4f88688029fff8dfb9ec0734f6e4cba3e7 upstream. Don't assume bank 0 is selected at device probe time. This may not be the case. Force bank selection at first register acc

[ 29/57] drm: restore open_count if drm_setup fails

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Ilija Hadzic commit 0f1cb1bd94a9c967cd4ad3de51cfdabe61eb5dcc upstream. If drm_setup (called at first open) fails, the whole open call has failed, so we should not keep the open_count incremente

[ 26/57] nfsd: add get_uint for u32s

3.4-stable review patch. If anyone has any objections, please let me know. -- From: "J. Bruce Fields" commit a007c4c3e943ecc054a806c259d95420a188754b upstream. I don't think there's a practical difference for the range of values these interfaces should see, but it would be saf

[ 25/57] NFSv4.1: We must release the sequence id when we fail to get a session slot

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Trond Myklebust commit 2240a9e2d013d8269ea425b73e1d7a54c7bc141f upstream. If we do not release the sequence id in cases where we fail to get a session slot, then we can deadlock if we hit a rec

[ 22/57] nfsv3: Make v3 mounts fail with ETIMEDOUTs instead EIO on mountd timeouts

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Scott Mayhew commit acce94e68a0f346115fd41cdc298197d2d5a59ad upstream. In very busy v3 environment, rpc.mountd can respond to the NULL procedure but not the MNT procedure in a timely manner cau

[ 11/57] cfg80211: fix antenna gain handling

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Felix Fietkau commit c4a9fafc77a5318f5ed26c509bbcddf03e18c201 upstream. No driver initializes chan->max_antenna_gain to something sensible, and the only place where it is being used right now i

[ 19/57] mac80211: verify that skb data is present

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit 9b395bc3be1cebf0144a127c7e67d56dbdac0930 upstream. A number of places in the mesh code don't check that the frame data is present and in the skb header when trying to acces

[ 50/66] net: fix divide by zero in tcp algorithm illinois

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Jesper Dangaard Brouer [ Upstream commit 8f363b77ee4fbf7c3bbcf5ec2c5ca482d396d664 ] Reading TCP stats when using TCP Illinois congestion control algorithm can cause a divide by zero kernel oop

[ 56/66] ipv6: send unsolicited neighbour advertisements to all-nodes

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Hannes Frederic Sowa [ Upstream commit 60713a0ca7fd6651b951cc1b4dbd528d1fc0281b ] As documented in RFC4861 (Neighbor Discovery for IP version 6) 7.2.6., unsolicited neighbour advertisements sh

[ 51/66] drivers/net/ethernet/nxp/lpc_eth.c: Call mdiobus_unregister before mdiobus_free

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Peter Senna Tschudin [ Upstream commit 57c10b61c84bfed68b1b317d6f507a392724b9c4 ] Based on commit b27393aecf66199f5ddad37c302d3e0cfadbe6c0 Calling mdiobus_free without calling mdiobus_unregis

[ 63/66] drm/radeon/si: add some missing regs to the VM reg checker

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit f418b88aad0c42b4caf4d79a0cf8d14a5d0a2284 upstream. This register is needed for streamout to work properly. Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Signed-o

[ 60/66] drm/vmwgfx: Fix hibernation device reset

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Hellstrom commit 95e8f6a21996c4cc2c4574b231c6e858b749dce3 upstream. The device would not reset properly when resuming from hibernation. Signed-off-by: Thomas Hellstrom Reviewed-by: Bri

[ 05/57] ath9k: Test for TID only in BlockAcks while checking tx status

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Sven Eckelmann commit 6fe7cc71bbf3a0bc28c9cec3c00bc11e81344412 upstream. The ath9k xmit functions for AMPDUs can send frames as non-aggregate in case only one frame is currently available. The

[ 00/57] 3.4.19-stable review

This is the start of the stable review cycle for the 3.4.19 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat Nov 17 04:09:24 UTC 2012. Anything receive

[ 04/57] ath9k: fix stale pointers potentially causing access to freed skbs

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Felix Fietkau commit 8c6e30936a7893a85f6222084f0f26aceb81137a upstream. bf->bf_next is only while buffers are chained as part of an A-MPDU in the tx queue. When a tid queue is flushed (e.g. on

[ 01/57] xen/gntdev: dont leak memory from IOCTL_GNTDEV_MAP_GRANT_REF

3.4-stable review patch. If anyone has any objections, please let me know. -- From: David Vrabel commit a67baeb77375199bbd842fa308cb565164dd1f19 upstream. map->kmap_ops allocated in gntdev_alloc_map() wasn't freed by gntdev_put_map(). Add a gntdev_free_map() helper function t

[ 03/57] Input: tsc40 - remove wrong announcement of pressure support

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Rolf Eike Beer commit 32ed1911fc79908d704023317d4ddeb3883fd07e upstream. The tsc40 driver announces it supports the pressure event, but will never send one. The announcement will cause tslib to

[ 18/57] mac80211: check management frame header length

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit 4a4f1a5808c8bb0b72a4f6e5904c53fb8c9cd966 upstream. Due to pskb_may_pull() checking the skb length, all non-management frames are checked on input whether their 802.11 heade

[ 17/57] drm/udl: fix stride issues scanning out stride != width*bpp

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Dave Airlie commit 3916e1d71b62b120888aa50bcc8d9a6200fc19a7 upstream. When buffer sharing with the i915 and using a 1680x1050 monitor, the i915 gives is a 6912 buffer for the 6720 width, the co

[ 16/57] DRM/Radeon: Fix Load Detection on legacy primary DAC.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Egbert Eich commit 83325d072185899b706de2956170b246585aaec9 upstream. An uninitialized variable led to broken load detection. Signed-off-by: Egbert Eich Signed-off-by: Alex Deucher Signed-of

[ 15/57] mac80211: dont inspect Sequence Control field on control frames

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Javier Cardona commit f7fbf70ee9db6da6033ae50d100e017ac1f26555 upstream. Per IEEE Std. 802.11-2012, Sec 8.2.4.4.1, the sequence Control field is not present in control frames. We noticed this

[ 14/57] mac80211: Only process mesh config header on frames that RA_MATCH

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Javier Cardona commit 555cb715be8ef98b8ec362b23dfc254d432a35b1 upstream. Doing otherwise is wrong, and may wreak havoc on the mpp tables, specially if the frame is encrypted. Reported-by: Chao

[ 13/57] mac80211: use blacklist for duplicate IE check

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit 9690fb169b433a66485c808e4fc352b8a0f8d866 upstream. Instead of the current whitelist which accepts duplicates only for the quiet and vendor IEs, use a blacklist of all IEs (

[ 12/57] wireless: drop invalid mesh address extension frames

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Johannes Berg commit 7dd111e8ee10cc6816669eabcad3334447673236 upstream. The mesh header can have address extension by a 4th or a 5th and 6th address, but never both. Drop such frames in 802.11

[ 10/57] target: Fix incorrect usage of nested IRQ spinlocks in ABORT_TASK path

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Steve Hodgson commit ab74b3d62f05192bf8fb8f169e7999d1183b2e08 upstream. This patch changes core_tmr_abort_task() to use spin_lock -> spin_unlock around se_cmd->t_state_lock while spin_lock_irqs

[ 09/57] iscsi-target: Fix missed wakeup race in TX thread

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Roland Dreier commit d5627acba9ae584cf4928af19f7ddf5f6837de32 upstream. The sleeping code in iscsi_target_tx_thread() is susceptible to the classic missed wakeup race: - TX thread finishes ha

[ 08/57] target: Avoid integer overflow in se_dev_align_max_sectors()

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Roland Dreier commit 3e03989b5868acf69a391a424dc71fcd6cc48167 upstream. The expression (max_sectors * block_size) might overflow a u32 (indeed, since iblock sets max_hw_sectors to UINT_MAX, it

[ 07/57] target: Dont return success from module_init() if setup fails

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Roland Dreier commit 0d0f9dfb31e0a6c92063e235417b42df185b3275 upstream. If the call to core_dev_release_virtual_lun0() fails, then nothing sets ret to anything other than 0, so even though ever

[ 02/57] xen/mmu: Use Xen specific TLB flush instead of the generic one.

3.4-stable review patch. If anyone has any objections, please let me know. -- From: Konrad Rzeszutek Wilk commit 95a7d76897c1e7243d4137037c66d15cbf2cce76 upstream. As Mukesh explained it, the MMUEXT_TLB_FLUSH_ALL allows the hypervisor to do a TLB flush on all active vCPUs. If

[ 66/66] xfs: fix buffer shudown reference count mismatch

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Dave Chinner commit 03b1293edad462ad1ad62bcc5160c76758e450d5 upstream. When we shut down the filesystem, we have to unpin and free all the buffers currently active in the CIL. To do this we unp

[ 65/66] xfs: fix reading of wrapped log data

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Dave Chinner commit 6ce377afd1755eae5c93410ca9a1121dfead7b87 upstream. Commit 4439647 ("xfs: reset buffer pointers before freeing them") in 3.0-rc1 introduced a regression when recovering log b

[ 64/66] GFS2: Test bufdata with buffer locked and gfs2_log_lock held

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Benjamin Marzinski commit 96e5d1d3adf56f1c7eeb07258f6a1a0a7ae9c489 upstream. In gfs2_trans_add_bh(), gfs2 was testing if a there was a bd attached to the buffer without having the gfs2_log_lock

[ 62/66] drm/radeon/cayman: add some missing regs to the VM reg checker

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Alex Deucher commit 860fe2f05fa2eacac84368e23547ec8cf3cc6652 upstream. These regs were being wronly rejected leading to rendering issues. fixes: https://bugs.freedesktop.org/show_bug.cgi?id=56

[ 61/66] drm/vmwgfx: Fix a case where the code would BUG when trying to pin GMR memory

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Hellstrom commit afcc87aa6a233e52df73552dc1dc9ae3881b7cc8 upstream. Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Dmitry Torokhov Cc: linux-graphics-maintai...@

[ 59/66] mmc: sdhci: fix NULL dereference in sdhci_request() tuning

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Chris Ball commit 14efd957209461bbdf285bf0d67e931955d04a4c upstream. Commit 473b095a72a9 ("mmc: sdhci: fix incorrect command used in tuning") introduced a NULL dereference at resume-time if an

[ 58/66] mmc: sh_mmcif: fix use after free

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Guennadi Liakhovetski commit a0d28ba01ebd048b4ba418142b37f5cf80e6d156 upstream. A recent commit "mmc: sh_mmcif: fix clock management" has introduced a use after free bug in sh_mmcif.c: in sh_mm

[ 57/66] futex: Handle futex_pi OWNER_DIED take over correctly

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Thomas Gleixner commit 59fa6245192159ab5e1e17b8e31f15afa9cff4bf upstream. Siddhesh analyzed a failure in the take over of pi futexes in case the owner died and provided a workaround. See: http:

[ 55/66] af-packet: fix oops when socket is not present

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Eric Leblond [ Upstream commit a3d744e995d2b936c500585ae39d99ee251c89b4 ] Due to a NULL dereference, the following patch is causing oops in normal trafic condition: commit c0de08d04215031d68f

[ 54/66] net: inet_diag -- Return error code if protocol handler is missed

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Cyrill Gorcunov [ Upstream commit cacb6ba0f36ab14a507f4ee7697e8332899015d2 ] We've observed that in case if UDP diag module is not supported in kernel the netlink returns NLMSG_DONE without no

[ 53/66] tcp-repair: Handle zero-length data put in rcv queue

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Pavel Emelyanov [ Upstream commit c454e6111d1ef4268fe98e87087216e51c2718c3 ] When sending data into a tcp socket in repair state we should check for the amount of data being 0 explicitly. Othe

[ 52/66] l2tp: fix oops in l2tp_eth_create() error path

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Tom Parkin [ Upstream commit 789336360e0a2aeb9750c16ab704a02cbe035e9e ] When creating an L2TPv3 Ethernet session, if register_netdev() should fail for any reason (for example, automatic naming

[ 43/66] sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Zijie Pan [ Upstream commit f6e80abeab928b7c47cc1fbf53df13b4398a2bec ] Bug introduced by commit edfee0339e681a784ebacec7e8c2dc97dc6d2839 (sctp: check src addr when processing SACK to update tr

[ 48/66] ipv6: Set default hoplimit as zero.

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Li RongQing [ Upstream commit 14edd87dc67311556f1254a8f29cf4dd6cb5b7d1 ] Commit a02e4b7dae4551(Demark default hoplimit as zero) only changes the hoplimit checking condition and default value i

[ 47/66] net: fix secpath kmemleak

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Eric Dumazet [ Upstream commit 3d861f661006606bf159fd6bd973e83dbf21d0f9 ] Mike Kazantsev found 3.5 kernels and beyond were leaking memory, and tracked the faulty commit to a1c7fff7e18f59e ("ne

[ 49/66] net: usb: Fix memory leak on Tx data path

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Hemant Kumar [ Upstream commit 39707c2a3ba5011038b363f84d37c8a98d2d9db1 ] Driver anchors the tx urbs and defers the urb submission if a transmit request comes when the interface is suspended.

[ 01/66] xen/gntdev: dont leak memory from IOCTL_GNTDEV_MAP_GRANT_REF

3.6-stable review patch. If anyone has any objections, please let me know. -- From: David Vrabel commit a67baeb77375199bbd842fa308cb565164dd1f19 upstream. map->kmap_ops allocated in gntdev_alloc_map() wasn't freed by gntdev_put_map(). Add a gntdev_free_map() helper function t

[ 09/66] target: Avoid integer overflow in se_dev_align_max_sectors()

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Roland Dreier commit 3e03989b5868acf69a391a424dc71fcd6cc48167 upstream. The expression (max_sectors * block_size) might overflow a u32 (indeed, since iblock sets max_hw_sectors to UINT_MAX, it

[ 10/66] iscsi-target: Fix missed wakeup race in TX thread

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Roland Dreier commit d5627acba9ae584cf4928af19f7ddf5f6837de32 upstream. The sleeping code in iscsi_target_tx_thread() is susceptible to the classic missed wakeup race: - TX thread finishes ha

[ 11/66] target: Fix incorrect usage of nested IRQ spinlocks in ABORT_TASK path

3.6-stable review patch. If anyone has any objections, please let me know. -- From: Steve Hodgson commit ab74b3d62f05192bf8fb8f169e7999d1183b2e08 upstream. This patch changes core_tmr_abort_task() to use spin_lock -> spin_unlock around se_cmd->t_state_lock while spin_lock_irqs

  1   2   >